Bypassing SELinux with init_module

TL;DR

There are two Linux system calls for loading a kernel module - init_module and finit_module. By leveraging init_module, I bypassed a filesystem-based SELinux rule that prevented me from loading a kernel module through traditional means (e.g., insmod). I then disabled SELinux from kernel-space. Proof of concept code can be found on my GitHub.

Leveraging ssh-keygen for Arbitrary Execution (and Privilege Escalation)

TL;DR

The ssh-keygen command can be used to load a shared library with the -D flag. This can be useful for privilege escalation (described below), or to translate to arbitrary code execution from argument injection, file overwrites, etc. Proof of concept code can be found on my GitHub (and here is a list of other tools that can be leveraged in the same way).